As of 13 August 2026, AI cannot check your employee monitoring for UK GDPR compliance.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the organisation's monitoring policy, privacy notice, DPIA, record of processing activities, processor contract and system settings, and make redacted copies that remove worker names and unnecessary personal data.
   2. Gather the concrete facts about what is monitored, when it runs, who is covered, the purposes, who can access the results, retention and deletion, worker notification or consultation, security, suppliers and any international transfers.
   3. Paste the redacted documents and facts into a chatbot with the supplied prompt, keeping each document labelled so the model can distinguish policy wording from actual system behaviour.
   4. Ask the model to produce the requested table of missing evidence, apparent issues, practical next steps and matters requiring professional review, without asking it to declare the arrangement compliant.
   5. Compare every legal or regulatory claim in the response with current ICO and GOV.UK guidance and with the organisation's actual records, correcting any statement that is unsupported or based on an assumption.
   6. Send the redacted evidence pack and the AI's gap analysis to your data protection officer, UK data protection solicitor or suitably qualified data protection specialist for the compliance decision and any required remediation.

   Prompt

   Act as a UK GDPR compliance review assistant, not a solicitor and not the final decision-maker. I need a preliminary gap analysis of employee monitoring at [organisation name]. Do not say that the arrangement is compliant or lawful. Instead, identify what facts are missing, map each stated practice to the relevant UK GDPR issue, explain the risk in plain English, and list the evidence or changes needed before a qualified reviewer can decide.
   
   Use only the facts and documents I provide. Do not invent legal bases, retention periods, worker expectations, consultation outcomes, contracts, policies or technical safeguards. Separate:
   1. facts supplied;
   2. assumptions or missing facts;
   3. apparent issues;
   4. questions for the organisation;
   5. actions to investigate or change;
   6. points that require a UK data protection solicitor or suitably qualified data protection specialist.
   
   Assess, where the information allows, the monitoring purpose and necessity, proportionality, lawful basis, special-category data, transparency to workers, automated decision-making, retention, access controls, processor and international-transfer arrangements, worker consultation, individual rights, security, and whether a data protection impact assessment is needed or adequate. Distinguish general information from professional advice. Do not recommend covert monitoring or suggest that a privacy notice alone fixes a disproportionate practice.
   
   Here are the materials and facts:
   - Monitoring tools and settings: [paste redacted details]
   - What is monitored, when and where: [details]
   - Business purposes: [details]
   - Who is monitored and who can view the data: [details]
   - Lawful basis and any special-category processing: [details]
   - Retention and deletion: [details]
   - Worker notices, consultation and policies: [paste relevant text]
   - DPIA, data flow, processor and transfer information: [paste relevant text]
   - Security and access controls: [details]
   - Current questions or incidents: [details]
   
   End with a table containing: issue, evidence relied on, missing evidence, likely concern, practical next step, and whether professional review is needed. Tell me exactly which claims I must verify against current ICO guidance, the organisation's records and the monitoring vendor's documents.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.